Quantum dice rolling: A multi-outcome generalization of quantum coin flipping 
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We generalize the problem of coin flipping to more than two outcomes and parties. 
We term this problem dice rolling, and study both its weak and strong variants. We 
prove by construction that in quantum settings (i) weak A'^-sided dice rolling admits an 
arbitrarily small bias for any value of A'^, and (ii) two-party strong A^-sided dice rolling 
saturates the corresponding generalization of Kitaev's bound for any value of A''. In 
addition, we make use of this last result to introduce a family of optimal 2m-party 
strong n^-sided dice rolling protocols for any value of m and n. 
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Q_^! Coin flipping (CF) is a cryptographic problem in which a pair of remote distrustful parties, usually referred to as 

■■ Alice and Bob, must generate a random bit that they agree on. There are two types of coin flipping protocols. In 

^/^ I weak CF one of the parties prefers one of the outcomes and the other prefers the opposite, whereas in strong CF each 

^T") ' party does not know the other's preference. The security of a CF protocol is quantified by the biases e\ and 

^ ■ = 0, 1); if P^'^ * and P^*' * are the maximal probabilities that a dishonest AHce or Bob can force the outcome i, 
^ then 

Q.: 6«=p,W*-i ze{0,i}. (1) 

^ ', The biases tell us to what extent each of the parties can increase beyond one half their chances of obtaining each of 
^ ■ the outcomes. In weak CF we associate each of the outcomes with a win of one party over the other. Hence, we are 
not interested in bounding the maximal losing probability and we consequently consider only two biases: ^i=Pi — 1/2, 

where P* is dishonest party i's maximal winning probability. e=max(e^, es), or e=max(e^\ e^^) in the 

, case of strong CF, is often referred to as the bias of the protocol. 

>'. n 

\C) , The problem of CF was first introduced by Blum in 1981, who analyzed it in classical settings [ll|. It was 
OO . subsequently shown that if there are no limitations on the parties' computational power a dishonest party can always 
I force any outcome they desire Ql- With the publication of the quantum key distribution protocol of Bennett and 
. Brassard in 1984 it was realized that many communication tasks that are impossible in a classical setting may 
Q^ ■ be possible in a quantum setting. In 1999 Goldenberg et al. introduced a quantum gambling protocol f3|j which is a 
, problem closely related to weak CF (see (!]). The first quantum (strong) coin flipping protocol per se was presented 
by Aharonov et al. in 2000 The protocol achieves a bias of %/2/4 ~ 0.354 Soon afterward Spekkens and 
Rudolph and independently Ambainis [9||, devised a strong CF protocol with a bias of 1/4. On the other hand, 
K*" • Kitaev subsequently proved that there is a limit to the efficacy of strong CF protocols [l3|: Any strong CF protocol 

■ must satisfy P^ • Pg > 1/2, i € {0, 1}. As regards weak CF, in 2002 Spekkens and Rudolph introduced a family 
H ] of three rounds of communication protocols in which both dishonest parties have a bias of (V2 — l)/2 ~ 0.207 [Tlj . 
■ - - ■ Mochon then improved upon Spekkens and Rudolph's result by constructing weak CF protocols with an infinite 
number of rounds [H, . These efforts culminated in a proof that weak CF with an arbitrarily small bias is possible 
[l3|- Most recently, building upon Mochon's latest result, Chailloux and Kerenidis devised a strong CF protocol, 
which saturates Kitaev's bound in the limit of an infinite number of rounds [15]. 



CF admits many generalizations. We may consider imbalanced coins, more than two outcomes, more than two 
parties, or indeed some or all of these possibilities combined. An analysis of multi-party strong CF - the problem of 
N remote distrustful parties having to decide on a bit - in quantum settings was carried out in [l3|, and similarly 
to the two-party case, it was shown that the use of quantum resources is advantageous. Even though it is usually 
mentioned only with respect to the balanced case, the general statement of Kitaev's bound reads 

P«*.p«*>P,, ze{0, 1}, (2) 

where Pi is the probability of the outcome i in an honest execution of the protocol. One of the results of this 
paper is the generalization of Chailloux and Kerenidis' optimal Strong CF protocol to cover the imbalanced case as 
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well. Similalry, also in the weak case, optimal protocols exist for every degree of imbalance [15|, thereby generalizing 
Mochon's aforementioned result. 

Somewhat surprisingly, CF has yet to be generaHzed to many outcomes. Indeed, even in classical settings this 
problem is nontrivial, as a dishonest party can no longer force with certainty all of the outcomes. In this paper we 
shall focus on two problems. In the first, which we term weak dice rolling (DR), N > 2 remote distrustful parties 
must agree on a number between 1 and N with party i preferring the i-th outcome. In the second, which we term 
strong DR, M remote distrustful parties must agree on a number between 1 and N without any party being aware 
of any other's preference. 

The paper is organized as follows. In section II we prove that, using quantum resources, weak A^-sided dice roUing 
with arbitrarily small bias is possible for any value of N. This result stands in marked contrast to the classical case, 
where, under certain conditions, an honest party always loses. Furthermore, to gain insight as to what biases are 
achievable with a minimal number of rounds of communication, we present a six-round weak three-sided DR protocol, 
which incorporates a three-round weak imbalanced CF protocol that generaHzes the results of Spekkens and Rudolph 
to the imbalanced case. In section III we generalize Kitaev's bound to any number of parties, M, and outcomes, N, 
and present a family of two-party protocols that saturate it for any value of N. We then make use of this family 
to extend this result to 2m-party n^-sided DR any for value of m and n. In the process, we generalize Chailloux 
and Kerenidis' optimal strong CF protocol to cover the imbalanced case. Finally, we analyze a family of three-round 
two-party strong iV-sided DR protocols for any value of A^. 

II. WEAK DICE ROLLING WITH ARBITRARILY SMALL BIAS 

The purpose of weak CF is to decide between two parties. Hence, its natural multi-outcome generalization is the 
problem of deciding between N > 2 parties. As opposed to weak CF, in weak N > 2-sided DR there are many 
different cheating scenarios, as any number of parties n < N may be dishonest. We shall be interested in the N 
"worst case" scenarios where all but one of the parties are dishonest and, moreover, are acting in unison. That is, 
the dishonest parties share classical and quantum communication channels and have a joint strategy. In addition, 
we shall require that the protocol be "fair" in the sense that the honest party's maximum losing probability be the 
same in each of these N scenarios. Of course, the security of the protocol can be evaluated with respect to any other 
cheating scenario, but as we shall consider only fair protocols, the security of any cheating scenarios is never poorer 
than that provided by the afore-mentioned N worst case scenarios. 

We begin by observing that in CF the bias has a complementary definition. Concentrating on weak CF, we could 
just as well define it as 

l^^P* -1/2, i = A,B (3) 

where P* = P*_^^ is the maximum probability that party i loses. According to this definition the bias tells us to what 
extent party j ^ i can increase other party i's chances of losing beyond one half. In the case of N parties, the bias q 
then tells us to what extent the A^ — 1 dishonest parties can increase party z's chances of losing beyond 1— 1/iV, rather 
than to what extent a sole dishonest party can increase its chances of winning beyond 1/N. We shall always use this 
redefinition of the bias when considering weak DR. The computation of biases in weak DR is therefore equivalent to 
the computation of biases in a weak imbalanced coin fiipping protocol. 

A. Weak dice rolling with arbitrarily small bias 

We shall now prove that quantum weak TV-sided DR with arbitrarily small bias is possible for any N. The proof is 
by construction. Consider the following iV-party protocol. Each party is uniquely identified according to a number 
from 1 to N. The protocol consists of — 1 stages. In stage one parties 1 and 2 "weakly fiip" a balanced quantum 
coin. The winner and party 3 then weakly fiip an imbalanced quantum coin in stage two, where if both parties are 
honest 3's winning probability equals 1/3. And so on, the rule being that in stage n>2 the winner of stage n—l and 
party n "weakly fiip" an imbalanced quantum coin, where if both parties are honest, n's winning probability equals 
1/ (n+ 1). Thus, if all parties are honest each has the same overall winning probability of 1/A^. Using Mochon's 
formaHsm Chailloux and Kerenidis have recently proved that weak imbalanced coin fiipping with arbitrarily small 
bias is possible It follows that in the limit where each of the weak imbalanced coin fiipping protocols, used to 
implement our DR protocol, admits a vanishing bias (and A^ is finite), any honest party's winning probability tends 



3 



to 1/iV; for a formal proof see appendix A. Moreover, since we have considered the worst case cheating scenario, this 
result holds for any other cheating scenario. 

The above result stands in stark contrast to the classical case where if the number of honest parties is not strictly 
greater than then the dishonest parties can force any outcome they desire. To see why this is so, let us consider 
a classical iV-sided dice rolling protocol and partition the parties into two groups of m < [-/V/2] and n = N — m 
parties. If both groups are honest, the probability that a party in the first (second) group wins is m/N (1 — m/N). 
Therefore, any weak DR protocol can serve as a weak imbalanced CF protocol. Suppose now that all of the parties in 
the second group are dishonest, and are nevertheless unable to force with certainty the outcome they choose. Clearly, 
this would still be the case even if they were the smaller group, i.e. n < m (m> [A^/2]), and we get a contradiction, 
since in classical weak imbalanced CF (as in the balanced case) at least one of the parties is always able to force 
whichever outcome they desire [T7| . 



B. A six-round weak three-sided dice rolling protocol 

Apart from the inherent limitations on the security of a multi-party quantum cryptographic protocol, it is interesting, 
both from a theoretical and a practical viewpoint, to determine what degree of security is afforded using the least 
amount of communication. In this section we introduce a six-round three-sided dice roUing protocol following the 
general construction presented in the second section. This construction gives rise to different biases dependent on 
the biases of the weak imbalanced CF protocol employed in each of its stages. Three-round weak imbalanced CF 
protocols to date have never been analyzed. In the next subsection we carry out just such an analysis, which is then 
used in the subsequent section obtain definite results for the DR protocol. 



A three-round weak imbalanced coin flipping protocol 

We introduce a three-round weak imbalanced coin flipping protocol based on quantum gambling. It is constructed 
such that if both parties are honest Alice's winning probability equals 1 — p. Interestingly, it turns out that this 
protocol coincides with the generaHzation of Spekkens and Rudolph's work to the imbalanced case. The protocol 
consists of three rounds: 

• Alice prepares a superposition of two qubits 



l^o) = Vl-P-'7lTii2) +VP+^UiT2), 0<?7<1-p, (4) 

where the subscripts serve to distinguish between the first and second qubit and will be omitted when the 
distinction is clear. She then sends the second qubit to Bob. 

• Bob carries out a unitary transformation Uri on the qubit he received and another qubit (labelled by the subscript 
3) prepared in the state ||.) such that 



|T2i3) - [/, |T2i3) = + J-^\i2U) , (5) 



and 



U2T3) ^ u, U2T3) = J^lhh) - U2T3) , (6) 



with Urj acting trivially on all other states. The resulting state is then 



Hl) = U^\^0) = VI ?7lTli2i3) + VPUlT2i3) + V^Uli2T3) . (7) 

Following this, he checks whether the second and third qubits are in the state |t2i3)- 

• Bob wins if he finds the qubits in the state |t2i3)- AHce then checks whether the first qubit is in the state ||), 
in which case Bob passes the test. If Bob does not find the qubits in the state |t2i3), he asks Alice for the first 
qubit and checks whether all three qubits are in the state 



10 =a/ \ ! p ITli2i3) + Uli2T3) , (8) 



in which case she passes the test. 
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As proved in appendix B Alice's maximal winning probability is given by 



while Bob's maximal winning probability is given by 

Pb=P + V- (10) 

In the balanced case a protocol is fair if = P^. We can play with rj to make and Pg minimal under this 

constraint. It is easy to show that the minimum then obtains for rj = — l) /2. It follows that ca = = 
{V2 - 1) /2 and P* = P* = 1/^2. 

A six-round weak three-sided dice rolling protocol with a bias of 0.181 

The protocol consists of two three-round stages. In the first stage, we have Alice and Bob weakly fiip a balanced 
quantum coin. Following this, in the second stage, the winner and Claire weakly flip an imbalanced quantum coin, 
such that if both parties are honest Claire's winning probability equals 1/3. The protocol is considered fair if 
PJ^ = Pg = Pq. Due to the protocol's symmetry with respect to the interchange of Alice and Bob there are only 
two nonequivalent worst case scenarios, i.e. either only Alice is honest or only Claire is honest. Using the quantum 
gambhng based protocol an honest AHce has a maximum chance of 1 — 1/^/2 of progressing to the second stage. 
Therefore, Alice's maximum losing probability is given by 

while an honest Claire's maximum losing probability is given by 

Ph = > (12) 

with n^yg (n^/s) the maximum losing probability of the party with a winning probability of 1/3 (2/3) when both 
parties are honest. Hence, we require that 

— (1- — 



If we use the WCF protocol of the previous section to implement the second stage, then HJ^g and 112^3, and hence the 

Pj*, will depend on ry. We then have to minimize the P^ with respect to rj under the constraint that they are all equal, or 
what is the same thing, minimize 11*^3 under the constraint eq. (13). However, there are two possible implementations. 

Either 1 — p = 2/3 and the second stage begins with Alice preparing the state -\/2/3 — r] |tii2) + -\/l/3 + jj |iit2), or 
else 1 — p = 1/3 and the second stage begins with Claire preparing the state -^1/3 — rj |tii2) + -\/2/3 + rj |iit2)- In 
the first case we have to compute 

minmax \ (v(2-3.)(l-.) + ^/I^) (14) 



under the constraint that 



2 

„.„l(v(2-3,)(l-*) + y'^^ (15) 



while in the second case we have to compute 



under the constraint that 



min U + ) (16) 




^+77) =-^+(^l--^)max( V(l-37?)(l-(5) + ^/7;^l^ ) . (17) 

The first of these yields the lower bias Za = = — 0.181 corresponding to P^ = P^ = P^ — 0.848. The second 
yields a bias of 0.199. 
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III. OPTIMAL TWO-PARTY STRONG DICE ROLLING & BEYOND 



In this section we consider the problem of M > 2 remote distrustful parties having to decide on a number between 
1 and > 3, without any party being aware of any other's preference. We generalize Kitaev's bound, eq. (2), to 
apply to this case as well, and present a protocol that saturates it for M — 2m parties and N — n™ outcomes for any 
value of m and n. In particular, this implies the possibility of optimal two-party strong TV-sided DR protocols for 
any value of N. To this end we also introduce a protocol that saturates Kitaev's bound for strong imbalanced CF, 
eq. (2). 

It is straightforward to adapt the original proofs of Kitaev's bound (lol . [l^ to cover more than two parties and 
outcomes. Instead, however, we note that strong DR can always be used to implement strong imbalanced CF. In 
particular, let us consider an M > 2-party strong TV-sided DR protocol. The probability for each of the outcomes in 
an honest execution is Pi = Suppose that we take the first A^ — 1 outcomes (last outcome) to represent (1) in 

an M-party strong imbalanced CF protocol, such that there is a {N — 1) jN probability of obtaining in an honest 

execution. Kitaev's bound can be generalized to cover this case as well and reads ' ' ■ • ■ ' > 

[l^ . where now Pj^^ gives the probability for the outcome 1 when all parties but the j-th are dishonest and acting 
in unison to force the outcome 1. It follows that this bound should apply to M-party strong TV-sided DR as well (for 
otherwise we get a contradiction). That is. 



Pf* -P^' -...-P^ri^^^ ZG{1,...,M}. (18) 



In the case of a protocol which is symmetric in the biases, i.e. for any value of i, j, fc, and I Pj = Pk ' then 
have that 

■ ^ ^ l/M 



,>[j^) , (19) 
where q now denotes the maximal probability of any of the — 1 parties to bias the result to any of the outcomes. 



A. Optimal strong imbalanced coin flipping 



To prove that the above bound can be saturated, we assume the existence of a strong imbalanced CF protocol 
saturating Kitaev's bound, eq. (2). Hence, we shall begin by presenting such a protocol, based on Chailloux and 
Kerenidis' optimal strong CF protocol: 

• Alice fiips an imbalanced coin, such that obtains with a probability q and 1 obtains with a probability I — q, 
and sends the outcome o to Bob. 

• If o = Alice and Bob carry out an optimal imbalanced weak CF protocol, where if both parties are honest 
Alice wins with probability zq and Bob wins with probability 1 — zq- If o = 1 Alice and Bob carry out an optimal 
imbalanced weak CF protocol, where if both parties are honest Alice wins with probability zi and Bob wins 
with probability 1 — zi . 

• If Alice wins the (weak) coin fiip, the outcome of the (strong CF) protocol is o. 

• If Bob wins the coin flip, then he weakly flips an imbalanced coin, whose degree of imbalance is dependent on o. 
When = 0, Bob flips an imbalanced coin such that its outcome is equal to (1) with probability po (1 — po)- 
When o = 1, Bob flips an imbalanced such that its outcome equals 1 (0) with probability pi (1 — pi). The 
outcome of this last coin flip is the outcome of the protocol. 

Denoting by Pi the probability of the outcome i when both parties are honest, we have that 



Po ^ q{zo + {1 ~ Zo)po) + {I - q) {1 - Zi) {1 - pi) , (20) 

and Pi = 1 — Pq. This protocol differs from Chailloux and Kerenidis' protocol in in that in the flrst round Alice 
performs an imbalanced coin flip, rather than a balanced one, and dependent on its outcome, she and Bob carry out 
different weak imbalanced CF protocols. In addition, if Bob wins then dependent on the value of o he flips one of 
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two different coins. Thus, instead of two free parameters we now have five. It is this extra freedom that allows the 
generalization to any degree of imbalance. 

To obtain the biases, suppose that a dishonest AHce tries to bias the outcome to 0. There are two ways that this 
can be achieved, either by announcing that she has obtained o = or by announcing that she has obtained o = 1. In 
the first case, her maximal probability of success equals 

Pf^* = zo + eo + {l-zo-eo)po, (21) 

where eo <C 1 is the bias of the weak imbalanced CF that is carried out when Alice inputs 0, while in the second case 
her maximal probability of success equals 

Q^°)* = l-pi. (22) 
Similarly, if Alice tries to bias the outcome to 1, her maximal probabilities of success equals 

P^2^* = zi + ei + {l- zi-ei)pi, (23) 
where ei <C 1 is the bias of the weak imbalanced coin flip, which is performed whenever Alice inputs 1, and 

Q^}^* = l-po. (24) 

Suppose now that a dishonest Bob tries to bias the outcome to 0. Given that in the first stage Alice outputs (1) 
probability q (1 — g), Bob's maximal probability of success is given by 

P4°^*=g+(l-g)(l-zi+ei) , (25) 
while if he tries to bias the outcome to 1, his maximal probability of success is given by 

P^^* = l-q + q{l-zo + eo) . (26) 

For ideal weak imbalanced CF (i.e. eo = ei = 0) this construction allows for Kitaev's bound to be exactly attained. 
This can be seen by imposing the following four constraints 

Pa*=Qa\ i = {0,l} (27) 

P«* = P«*, ie{0, 1} (28) 
Solving these equations together with eq. (20) we get 



^ 2 



i(l + /f^-x/A) , (29) 



PO = l-VPl, Pl = l-^/^, (30) 



Zl = l+ ^ ° , Z2^l+ ^ ' . (31) 

Note that for Pi € [0, 1] q, Zi, and pi also in the required range of values, i.e. [0, 1]. Substituting back into eqs. (21) 
to (26) we get 

Pr*=Pr* = x/^, P'r=PL''*-^/^i- (32) 
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Returning to the non-ideal case, using for q, the Zi, and the Pi the values just obtained, from eqs. (21) to (26) we 
have that 



P^b''* = V^o + \ei {1-^0 + , Pi'^* = VA + ieo(l + V^- V^) . (34) 

(Note that we no longer require that the constraints eqs. (27) and (28) be satisfied.) Since the Cj can be made 
arbitrarily small, it follows that the protocol saturates Kitaev's bound for any degree of imbalance. 

B. Optimal two-party strong dice rolling 

Equipped with the above result we proceed to prove the possibility of two-party strong A''-sided DR saturating 
Kitaev's bound for any value of N. Consider the following strong A^-sided DR protocol. In the first round the parties 
carry out a strong imbalanced CF protocol such that there is a \N/2] ([iV/2j) probability for the outcome (1). If 
the outcome of the coin flip is (1), then they agree that the DR protocol's outcome is (is not) going to lie between 
1 and \N/2\. Suppose that the first coin flip results in 0. Then in the second round they "strongly" flip another coin 
such that there is a \\N/2] /2] ([[^721 /2J) probability for the outcome (1). If the outcome is (1) then they 
agree that the DR protocors outcome is going to lie between 1 and [[A^/2] /2] ([[A^/2] /2] + I and [A^/2]), and so 
on until they obtain a single result (see Fig. 1). The probability of obtaining 1 in an honest execution equals 

\N/2\_ \\N/2] /21 1 _ 1 

TV [iV/2] [... [[7V/2] /2] .../2] N ^ ^ 

It is straightforward to verify that this probability is true of all other outcomes. Let us now consider a dishonest 
execution of the protocol such that the biases of the underlying strong imbalanced CF protocols are all equal to 
(5 <C 1/ riog2 N] . The probability of obtaining the outcome 1 is given by 

where c ^ (The formal proof follows along the same lines as that given in the appendix for weak DR, and 

so is omitted.) Similar expressions obtain for the probabilities of all other outcomes. Hence, we have shown that the 
this construction saturates the generalization of Kitaev's bound, eq. (18), for M = 2 and any N. 

C. A family of optimal multi-party strong dice rolling protocols 

The above construction readily allows for the introduction of a family of 2m-party strong n^-sided DR protocols 
saturating the generalization of Kitaev's bound, eq. (18). The idea is to sequentially have distinct pairs of parties 
strongly roll a dice to eliminate some of the outcomes, until a single outcome is obtained. Thus, in the case of four 
parties and nine outcomes, in the first stage the first and second parties strongly roll a three-sided dice. If its outcome 
is 1, outcomes 4 to 9 are eliminated, while if its outcome is 2, outcomes 1 to 3 and 7 to 9 are eliminated, etc. Suppose, 
for example, that outcomes 1 to 6 are eliminated. Then in the second stage parties three and four strongly roll a 
three-sided dice, where if its outcome is 1, then the final outcome of the protocol is 7, while if its outcome is 2, then 
the final outcome is 8, etc. In general, for 2m-parties and an n™-sided dice, the protocol consists of n stages. In each 
stage a different pair of parties strongly rolls an n-sided dice. As there are a total of 2m parties, each party strongly 
participates in a dice roll once. In order to force the outcome they desire, the 2m — 1 dishonest parties must bias the 
result of the dice roll in which the honest party participates, and since at any stage there is only a single outcome 
that can lead to the desired outcome, the dishonest parties can maximally bias the outcome with a probability of 

1 /2 

(l/n) ' -|- e, which saturates the generahzation of Kitaev's bound, eq. (18). 

It is not straightforward to generalize this scheme to any number of parties and outcomes. The problem is that we 
have introduced an ordering, which dependent on it, may in general render the protocol asymmetric in the biases, or 
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Figure 1: Two-party strong five-sided DR protocol saturating Kitaev's bound. The digits inside the boxes denote the possible 
outcomes. Each branching represents a strong imbalanced coin flip. The fractions beside each branch give the probability for 
the outcomes within the box below conditional on the outcomes in the box above. Thus, for the leftmost branch we have that 
the probability for the outcome equals 1/2 • 2/3 ■ 3/5 = 1/5, etc. 

even trivial by allowing the dishonest parties to force the outcome that they desire. This can be fixed by making use 
of optimal weak DR to decide the ordering. Unfortunately, this comes at the expense of optimality, i.e. eq. (18) is 
no longer saturated. Nevertheless, protocols incorporating optimal weak and strong DR protocols may give rise to 
biases remarkably close to the inherent bounds. As an example, consider the following three-party strong three-sided 
DR protocol. In the first round Alice, Bob and Clare weakly roll a three-sided dice. The winner then randomly 
selects a number a G {1, 3} and informs the two losers of his/her choice. The two losers then strongly fiip a coin. 
Denote its outcome by 5 € {0, 1}. The outcome of the protocol is (a -I- b) mod 3. It is easy to verify that the maximal 
probability of any two parties to successfully bias to any of the outcomes approximately equals 0.69363, while from 
eq. (19) q = (1/3)^^^ ~ 0.69336. That is, a difference of 0.027%. Similarly, to the optimal 2m-party n"-sided DR 
protocols described above, this protocol can be generalized to a family of 3n-party 3"-sided DR protocol, with each 
giving rise to the same bias. 

To complete the discussion we should mention that strong DR is nontrivial also in classical settings. Indeed, the 
classical biases for two-party TV-sided DR are constrained by the following set of inequalities [l3| 

(l - P« (l - Pi/) > ^ + , . , e {1, . . . , TV} . (37) 

It is straightforward to verify that these inequalities are "weaker" than the corresponding Kitaev bound, and hence 
allow for higher biases. 

D. A family of three-round two-party strong dice rolling protocols 

In this subsection we introduce a family of three-round strong DR protocols, which generalizes Colbeck's 
entanglement-based strong CF protocol jl^ to any number of outcomes. Suppose Alice and Bob want to strongly 
roll an TV-sided dice using a minimal number of rounds of communication. Then they may proceed as follows. Alice 
prepares a pair of systems in the state \tpN) ^ \iPn), where \iPn) = Sili N) ® N)' ^'^d sends the second half of 
each system to Bob. Bob randomly selects one of the systems to serve as the dice and informs Alice of his selection. 
Alice and Bob then measure their half of the selected system in the Schmidt basis. The outcome of this measurement 
is the outcome of the dice roll. Finally, Alice sends Bob her half of system that was not selected, and he verifies it 
was indeed prepared in the state IV'Jv)- 

Following a similar argument to Colbeck's, Alice's and Bob's maximal probabilities of biasing to any of the outcomes 
are given by 



(38) 
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Thus, for N = 3 e^^ = P^'' * - 1/3 = 1/3 and e^^ = P|' * - 1/3 = 2/9. Interestingly, in the Hmit where N ^ oo, 

P^* ^ 1/2 , Pg 2/7V, so that P^ • Pg ^ l/iV. Hence, in this limit Kitaev's bound is nontrivially saturated 
in a finite number of rounds, albeit at a cost of a high asymmetry of the biases. 



IV. CONCLUSIONS 



We have defined a novel mutli-outcome generalization of quantum CF, which we have termed quantum DR. We 
have analyzed both its weak and strong variants. Specifically, we proved by construction that in quantum settings (i) 
weak A^-sided dice rolling - the problem of N remote distrustful parties having to decide on a number between 1 and 
N with party i preferring the i-th outcome - admits an arbitrarily small bias for any value of A^, and (ii) two-party 
strong A/'-sided dice rolling - the problem of two remote distrustful parties having to decide on a number between 
1 and N without any party being aware of the other's preference - saturates the corresponding generalization of 
Kitaev's bound for any value of N. In addition, we also made use of this last result to introduce a family of optimal 
2m-party strong n™-sided DR protocols for any value of m and n. The question of whether this is also possible in 
the general case of any number of parties and outcomes remains open for now. 
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Appendix A 



For any weak DR protocol, based on weak imbalanced CF according to the scheme presented in section II, party 
n's maximum chance of losing is given by 

N -1 

P*n = ^^+^"" (Al) 

= n:_i + ^n;n(i-n:-i+,) 

fe=n j=0 

k=n j=l 

where is party n's maximum chance of losing stage k conditional on having made it to that round and dk the 
corresponding bias. If we now let 5max= max^ Sk and S^i^= min/; 6k {k = n — 1, . . . , N — 1), then 

JV— 1 / ^ X k-n-l / , . x AT-l / N k—n-1 / , . 



"mm 2^ U "max I I "mm) + j + I 



n + j + 1 



k=n m=l j^m 

N-1 ^ k-n-l 



< 



Hence, if each of the weak imbalanced CF protocols, used to implement the DR protocol, are such that 
for any n, an honest party's winning probability tends to 1/A''. 
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Appendix B 

Alice's maximal bias 



Most generally Alice can prepare any state of the form 



IV'o) = '^ii l*'^') ® ' 



(Bl) 



where the are states of some ancillary system at her possession. After Bob applies t/^ the resulting composite 

state is given by 



(B2) 



P 



p + rj 



ITTi) 



p + rj 



int) <^l$TT)+aTilTii)<»|*u) 



+Q!iT 



^ UTi) + A/rr-: Uit) ) ® l^it) + «u Uii) ® l^u) • 



P+V \ P+V 

The probability that Bob does not find find the second and third qubits in the state |t2i3) is 



and the resulting composite state then is 



p _i p _i I«ttI^p + I^itI^p 
j-'ii = 1 — i-'t I =1 



Ti 



P + V 



(B3) 



+aiT 



p + r] 



liiT)0|*iT)+auUii)®l^u) 



where N, the normalization, is 

^=i-^(KTr+KTr)- 

The probability that AHce passes the test is therefore given by 



^'test = ||(el^2)ll'=^' 



(1 -p){p + T]) 



(B4) 



(B5) 



(B6) 



The maximum obtains for = |^'j,t)- This choice of the ancillary states does not affect the maximum of P^i- 

Hence, Alice obtains no advantage by using ancillary systems and we can do away with them. Alice's maximum 
cheating probability is then 



Pa =maxPt| -Pt 



where now 



1 — p — r] 

"^^nl i_p 



(l-p) {p + v) 



(B7) 



(B8) 



{P-\l = Clearly, this expression is maximum when ai-f = an = 0. Therefore, to maximize her chance of 

successfully cheating Alice will prepare a state of the form 



iv;^) = x/r^iTa2) + \/^iiiT2) , 

where with no loss of generality we have set a-^i = \/l — 5 and aii = y/S. So that 



P4 = max I 



'{l-p-7j)il-5) 



l-p 



+ 



rf-5 



(1 -p){p + rf) 



(B9) 



(BIO) 
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Bob's maximal bias 



Bob wins and passes the test whenever AHce does not find the first qubit in the state |t). The probabiHty for 
this is just p + T]. This gives an upper bound on Bob's maximal cheating probabiUty, which is reached if Bob always 
announces that he has won. That is, 

P*B=P + r]. (Bll) 
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